What we store, and why

The short version

You can browse every trail without an account. An account is needed for downloads, saved trails and community contributions. We store the account and dog information you give us so those features work across devices. We do not run ads or sell personal data. Reviews, trail photos and hazard reports can become public after moderation; private dog and health details never do.

What we store when you have an account

• Your login — your email address (or your Google account, if you sign in with Google). Authentication is handled by Google Firebase; we never see or store your password.
• Your dog's profile — name, breed, age, weight, fitness and any health notes you add, plus an optional photo. This exists purely to score trails for your dog.
• Your private activity — saved trails, recent match results and structured post-hike feedback. Journal entries and hike recordings stay on your device instead.
• Community posts — reviews, condition reports and trail photos you submit for moderation. Approved posts become public and appear with your dog's first name (“Rufus's human”), never your email.

Login, private profile data, private outcomes and community contributions are stored in Google Firebase. Community contributions are stored separately from your private account record so they can be moderated.

How long each kind of data stays

• Login, dog profiles, saved trails and match history: kept while your account exists and deleted when you cancel it.
• Private post-hike outcomes: kept while your account exists and deleted with it. An unsent copy may remain on this device until it syncs or you clear local data.
• Downloaded trail packages: kept only in this browser until you remove them, the browser evicts them, or you choose complete device cleanup. They are public map data, so you may choose to keep them after logout or account deletion.
• An active hike: kept only in this browser. It stops being recoverable 36 hours after its last update and is removed when it is replaced or you clear local data.
• Completed hikes and journal entries: kept only in this browser until you remove them or clear local data. ORMA does not sync the journal to the server.
• Reviews, trail photos and hazard reports: kept while published, pending moderation or needed to preserve the safety history. The author or a moderator can remove a contribution. Cancelling an account does not automatically remove these records.
• Abuse reports and moderation audit records: normally kept for up to 24 months after resolution or the last moderation action. They may be kept longer only while an active safety dispute or legal obligation requires it.
• Optional product analytics: queued in this browser for no more than 30 days and capped at 200 events. Turning analytics off removes the queue and random browser identifier immediately.
• Anonymous hike-start counters: timestamp-only rows are kept for no more than 90 days. Only the last seven days are used for the public “dogs hiked this week” count.

The 90-day counter cleanup and 24-month moderation cleanup are operator retention checks rather than client-side deletion. Records subject to an active safety or legal hold are reviewed when that hold ends.

What stays on your device

Your browser stores downloaded maps, active and completed hike records, journal entries, pending post-hike outcomes, community contributions waiting to sync, dog photos and small preferences or caches. Queued contributions stay private on this device until Firestore accepts them for moderation. On logout, you choose between keeping public downloads or removing all ORMA local data. Account deletion gives you the same clear choice. Your browser may also evict local data under its own storage rules.

Anonymous counters

When someone starts hike mode on a trail, we count it — trail id and timestamp, nothing else. No account, no location, no device identifiers. It powers the “dogs hiked this week” number.

Anonymous product usage is separate and optional. It is off until you enable Share anonymous product usage in Settings. Allowed events use a random browser identifier, hour-level timestamps and predefined categories; they reject names, email addresses, search text, reviews, health notes, exact coordinates and GPS history. Events waiting offline are discarded after 30 days. Switching the setting off deletes that queue and its identifier immediately.

Third parties

• Google Firebase — authentication and database (see above).
• GitHub Pages — hosts the site; like any web host it keeps standard server logs.
• Google Fonts, OpenStreetMap / OpenMapTiles — your browser fetches fonts and map tiles from their servers when pages and maps load.

We run no advertising or third-party tracking scripts.

Deleting or correcting your data

Open your account page and choose Cancel account. This deletes your sign-in, dog profiles, saved trails, match history and private post-hike outcomes. You then choose whether this browser also removes downloaded public maps; every other private local record is removed either way.

Community content and safety or moderation records are handled separately. They are not automatically erased with the private account because an approved review may still inform hikers and a moderation record may be needed to resolve abuse or meet a legal obligation. To request removal or correction of a contribution, or if you cannot access your account, email hello@dolopaws.com. We will remove it unless a current safety or legal reason requires limited retention, and we will tell you if that applies.

Questions

Anything unclear, or a request this page doesn't cover: hello@dolopaws.com.